Day - 6 | AWS VPC Example

🧠 AWS VPC Example: Private Subnets with NAT Gateway — Explained

In modern cloud architectures, isolating application servers from direct internet access while still enabling outbound connectivity is a common requirement. AWS supports this pattern using private subnets and a NAT Gateway inside a Virtual Private Cloud (VPC). In this blog, I’ll walk you through what this setup is, how it works, and why it matters.

This example is inspired by the AWS VPC User Guide, which shows how to configure a VPC with both public and private subnets and use a NAT gateway for secure outbound access.

🌐 What Are Public and Private Subnets?

A VPC is a logically isolated network in AWS where you can launch cloud resources like EC2 instances. Within a VPC, you can create:

• Public subnets: These have a route to an Internet Gateway, so resources here can communicate directly with the internet.

• Private subnets: These do not have internet access by default, so servers in private subnets remain isolated for security.

🛡️ Why Use Private Subnets with NAT Gateways?

There are times when servers shouldn’t be publicly reachable — for example:

• Application servers

• Backend services

• Databases

However, these servers sometimes still need outbound internet access to:

• Download updates

• Reach external APIs

• Communicate with AWS services

This is where a NAT (Network Address Translation) Gateway comes in.

A NAT Gateway is deployed in a public subnet and enables instances in private subnets to send traffic to the internet without exposing them to inbound internet connections.

📍 How Traffic Works

Here’s how traffic flows in this design:

• Inbound traffic from the internet goes first to the public subnet (typically via a Load Balancer or publicly accessible server).

• Private subnet instances cannot receive inbound traffic directly from the internet.

• But when these private instances need to outbound access the internet (e.g., for updates), their traffic is routed through the NAT Gateway in the public subnet.

• The NAT Gateway then sends the traffic to the internet using its Elastic IP address and returns response traffic back securely.

• 🛡️ Security Benefits

  This design offers strong security and high availability:

  • Isolated private resources: Servers are not directly reachable from the internet.

  • Outbound connectivity: Servers can still download packages or access external services.

  • Resiliency: Deploying NAT gateways in each AZ increases fault tolerance.

🚀 When to Use This Pattern

This setup is ideal when you:

• Run application servers that need outbound access

• Want to keep backend resources hidden from the internet

• Need scalable and secure cloud infrastructure.

🧠 Summary

Configuring a VPC with private subnets and NAT gateways lets you build secure, production-ready cloud networks. This pattern ensures that your crucial application servers remain isolated while still having the ability to communicate with external services when necessary.

By following this architectural pattern, you get the best of both worlds — security and connectivity.

1️⃣ Architecture Diagram (for Blog)

You can include this logical diagram explanation in your blog:

Internet
   |
[ Internet Gateway ]
   |
[ Public Subnet ]
   |
[ NAT Gateway ]
   |
[ Private Subnet ]
   |
[ EC2 Instances ]

🔎 How it works

• Public Subnet

  • Has a route to the Internet Gateway

  • Hosts the NAT Gateway

• Private Subnet

  • No direct internet access

  • Routes outbound traffic to the NAT Gateway

• NAT Gateway

  • Allows outbound internet access

  • Blocks inbound internet access

✅ This ensures security + controlled internet access.

2️⃣ AWS CLI Commands (Beginner-Friendly)

🔹 Create VPC

aws ec2 create-vpc --cidr-block 10.0.0.0/16

🔹 Create Subnets

# Public Subnet
aws ec2 create-subnet --vpc-id vpc-id --cidr-block 10.0.1.0/24

# Private Subnet
aws ec2 create-subnet --vpc-id vpc-id --cidr-block 10.0.2.0/24

🔹 Create Internet Gateway

aws ec2 create-internet-gateway
aws ec2 attach-internet-gateway \
  --internet-gateway-id igw-id \
  --vpc-id vpc-id

🔹 Create NAT Gateway

aws ec2 allocate-address --domain vpc

aws ec2 create-nat-gateway \
  --subnet-id public-subnet-id \
  --allocation-id eip-alloc-id

🔹 Route Tables

# Public route
0.0.0.0/0 → Internet Gateway

# Private route
0.0.0.0/0 → NAT Gateway